Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
1,142 results · page 12 of 23
Aug 14, 2023In checkDebuggingDisallowed of DeviceVersionFragment.java, there is a possible way to access adb before SUW completion due to an insecure default value.CVE-2023-35689 · Computers, phones & browsers · Google · reported by security@android.comHigh 7.8
In checkDebuggingDisallowed of DeviceVersionFragment.java, there is a possible way to access adb before SUW completion due to an insecure default value. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsource.android.comsource.android.com
Aug 10, 2023Incorrect default permissions in some Intel(R) SDP Tool software before version 1.4 build 5 may allow an authenticated user to potentially enable escalation of CVE-2023-31246 · Other software · Intel · reported by secure@intel.comMedium 6.7
Incorrect default permissions in some Intel(R) SDP Tool software before version 1.4 build 5 may allow an authenticated user to potentially enable escalation of privilege via local access.
- Product
- Server Debug And Provisioning Tool
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 9, 2023An access control vulnerability was found, due to the restrictions that are applied on actual assertions not being enforced in their debug functionality.CVE-2023-24471 · Other software · Nozomi Networks · reported by prodsec@nozominetworks.comHigh 7.1
An access control vulnerability was found, due to the restrictions that are applied on actual assertions not being enforced in their debug functionality. An authenticated user with reduced visibility can obtain unauthorized information via the debug functionality, obtaining data that would normally be not accessible in the Query and Assertions functions.
- Product
- Guardian
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.nozominetworks.comsecurity.nozominetworks.com
Jul 27, 2023TeleAdapt RoomCast TA-2400 1.0 through 3.1 is vulnerable to Improper Access Control; specifically, Android Debug Bridge (adb) is available.CVE-2023-33743 · Other software · teleadapt · reported by MITRECritical 9.8
TeleAdapt RoomCast TA-2400 1.0 through 3.1 is vulnerable to Improper Access Control; specifically, Android Debug Bridge (adb) is available.
- Product
- roomcast_ta-2400
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.compacketstormsecurity.com
Jul 24, 2023wpForo Forum: Does not escape some request parameters while in debug modeCVE-2023-2309 · WordPress plugins & themes · reported by WPScanMedium 6.1
The wpForo Forum WordPress plugin before 2.1.9 does not escape some request parameters while in debug mode, leading to a Reflected Cross-Site Scripting vulnerability.
- Product
- wpForo Forum
- Fixed in
- 2.1.9
- What to do
- Update wpForo Forum to 2.1.9 or newer.
Jul 18, 2023ChakraCore branch master cbb9b was discovered to contain a stack overflow vulnerability via the function Js::ScopeSlots::IsDebuggerScopeSlotArray().CVE-2023-37139 · Computers, phones & browsers · Microsoft · reported by MITREMedium 5.5
ChakraCore branch master cbb9b was discovered to contain a stack overflow vulnerability via the function Js::ScopeSlots::IsDebuggerScopeSlotArray().
- Product
- Chakracore
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 11, 2023Cross-Site Request Forgery (CSRF) vulnerability in Danny Hearnah - ChubbyNinjaa Template Debugger plugin <= 3.1.2 versions.CVE-2023-35773 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Danny Hearnah - ChubbyNinjaa Template Debugger plugin <= 3.1.2 versions.
- Affected
- up to 3.1.2
- What to do
- Affects up to 3.1.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Jul 5, 2023In MADEFORNET HTTP Debugger through 9.12, the Windows service does not set the seclevel registry key before launching the driver.CVE-2023-35863 · Other software · Madefornet · reported by MITREMedium 5.3
In MADEFORNET HTTP Debugger through 9.12, the Windows service does not set the seclevel registry key before launching the driver. Thus, it is possible for an unprivileged application to obtain a handle to the NetFilterSDK wrapper before the service obtains exclusive access.
- Product
- Http Debugger
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordctrl-c.clubmadefornet.com
Jun 15, 2023In multiple functions of multiple files, there is a possible way to bypass the DISALLOW_DEBUGGING_FEATURES restriction for tracing due to a missing permission cCVE-2023-21123 · Computers, phones & browsers · Google · reported by security@android.comHigh 7.8
In multiple functions of multiple files, there is a possible way to bypass the DISALLOW_DEBUGGING_FEATURES restriction for tracing due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11 Android-12 Android-12L Android-13Android ID: A-270050064
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsource.android.comsource.android.com
Jun 15, 2023In various functions of various files, there is a possible way to bypass the DISALLOW_DEBUGGING_FEATURES restriction for tracing due to a missing permission cheCVE-2023-21122 · Computers, phones & browsers · Google · reported by security@android.comHigh 7.8
In various functions of various files, there is a possible way to bypass the DISALLOW_DEBUGGING_FEATURES restriction for tracing due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11 Android-12 Android-12L Android-13Android ID: A-270050191
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsource.android.comsource.android.com
Jun 14, 2023A debug function in the lua-resty-json package, up to commit id 3ef9492bd3a44d9e51301d6adc3cd1789c8f534a (merged in PR #14) contained an out of bounds access buCVE-2023-3040 · Other software · Cloudflare · reported by cna@cloudflare.comLow 3.7
A debug function in the lua-resty-json package, up to commit id 3ef9492bd3a44d9e51301d6adc3cd1789c8f534a (merged in PR #14) contained an out of bounds access bug that could have allowed an attacker to launch a DoS if the function was used to parse untrusted input data. It is important to note that because this debug function was only used in tests and demos, it was not exploitable in a normal environment.
- Product
- lua-resty-json
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 8, 2023A debug feature in Sensormatic Electronics Illustra Pro Gen 4 Dome and PTZ cameras allows a user to compromise credentials after a long period of sustained attaCVE-2023-0954 · Other software · Sensormatic Electronics, a subsidiary of Johnson Controls, Inc. · reported by productsecurity@jci.comHigh 8.3
A debug feature in Sensormatic Electronics Illustra Pro Gen 4 Dome and PTZ cameras allows a user to compromise credentials after a long period of sustained attack.
- Product
- Illustra Pro Gen 4 Dome
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcisa.govjohnsoncontrols.com
Jun 2, 2023An attacker could have caused memory corruption and a potentially exploitable use-after-free of a pointer in a global object's debugger vector.CVE-2023-29543 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgHigh 8.8
An attacker could have caused memory corruption and a potentially exploitable use-after-free of a pointer in a global object's debugger vector. This vulnerability affects Firefox for Android < 112, Firefox < 112, and Focus for Android < 112.
- Product
- Firefox for Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.mozilla.orgmozilla.org
May 22, 2023Bitcoin Core before 24.1, when debug mode is not used, allows attackers to cause a denial of service (e.g., CPU consumption) because draining the inventory-to-sCVE-2023-33297 · Other software · Bitcoin · reported by MITREHigh 7.5
Bitcoin Core before 24.1, when debug mode is not used, allows attackers to cause a denial of service (e.g., CPU consumption) because draining the inventory-to-send queue is inefficient, as exploited in the wild in May 2023.
- Product
- Bitcoin Core
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorden.bitcoin.itgithub.com
May 19, 2023Active Debug Code vulnerability in Mitsubishi Electric Corporation MELSEC WS Series WS0-GETH00200 Serial number 2310 **** and prior allows a remote unauthenticaCVE-2023-1618 · Other software · Mitsubishi Electric Corporation · reported by Mitsubishielectric.Psirt@yd.MitsubishiElectric.co.jpHigh 7.5
Active Debug Code vulnerability in Mitsubishi Electric Corporation MELSEC WS Series WS0-GETH00200 Serial number 2310 **** and prior allows a remote unauthenticated attacker to bypass authentication and illegally log into the affected module by connecting to it via telnet which is hidden function and is enabled by default when shipped from the factory. As a result, a remote attacker with unauthorized login can reset the module, and if certain conditions are met, he/she can disclose or tamper with the module's configuration or rewrite the firmware.
- Product
- MELSEC WS Series WS0-GETH00200
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 11, 2023kodbox <= 1.37 is vulnerable to Cross Site Scripting (XSS) via the debug information.CVE-2023-29791 · Other software · Kodcloud · reported by MITREMedium 6.1
kodbox <= 1.37 is vulnerable to Cross Site Scripting (XSS) via the debug information.
- Product
- Kodbox
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.mo60.cnblog.mo60.cn
May 7, 2023A buffer overflow in the component /proc/ftxxxx-debug of FiiO M6 Build Number v1.0.4 allows attackers to escalate privileges to root.CVE-2023-30257 · Other software · Fiio · reported by MITREHigh 7.8
A buffer overflow in the component /proc/ftxxxx-debug of FiiO M6 Build Number v1.0.4 allows attackers to escalate privileges to root.
- Product
- M6 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comstigward.github.io
May 4, 2023Improper input validation vulnerability in FactoryTest application prior to SMR May-2023 Release 1 allows local attackers to get privilege escalation via debuggCVE-2023-21502 · Computers, phones & browsers · Samsung Mobile · reported by mobile.security@samsung.comMedium 5.7
Improper input validation vulnerability in FactoryTest application prior to SMR May-2023 Release 1 allows local attackers to get privilege escalation via debugging commands.
- Product
- Samsung Mobile Devices
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.samsungmobile.comsecurity.samsungmobile.com
May 4, 2023Active Debug Code vulnerability in ActivityManagerService prior to SMR May-2023 Release 1 allows attacker to use debug function via setting debug level.CVE-2023-21496 · Computers, phones & browsers · Samsung Mobile · reported by mobile.security@samsung.comMedium 6.1
Active Debug Code vulnerability in ActivityManagerService prior to SMR May-2023 Release 1 allows attacker to use debug function via setting debug level.
- Product
- Samsung Mobile Devices
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.samsungmobile.comsecurity.samsungmobile.com
Apr 27, 2023Lightbend Alpakka Kafka before 5.0.0 logs its configuration as debug information, and thus log files may contain credentials (if plain cleartext login is configCVE-2023-29471 · Other software · Lightbend · reported by MITREMedium 5.5
Lightbend Alpakka Kafka before 5.0.0 logs its configuration as debug information, and thus log files may contain credentials (if plain cleartext login is configured). This occurs in akka.kafka.internal.KafkaConsumerActor.
- Product
- Alpakka Kafka
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 19, 2023Unprotected Alternate Channel vulnerability in debug console of GateManager allows system administrator to obtain sensitive information.CVE-2023-0317 · Other software · Secomea · reported by VulnerabilityReporting@secomea.comMedium 4.9
Unprotected Alternate Channel vulnerability in debug console of GateManager allows system administrator to obtain sensitive information.
- Product
- GateManager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecomea.comsecomea.com
Apr 12, 2023The Android version of pikpak v1.29.2 was discovered to contain an information leak via the debug interface.CVE-2023-27703 · Other software · Mypikpak · reported by MITRELow 3.3
The Android version of pikpak v1.29.2 was discovered to contain an information leak via the debug interface.
- Product
- Pikpak
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddrive.google.comgithub.com
Apr 12, 2023The Logback component in Terminalfour before 8.3.14.1 allows OS administrators to obtain sensitive information from application server logs when debug logging iCVE-2023-23591 · Other software · Terminalfour · reported by MITREMedium 4.9
The Logback component in Terminalfour before 8.3.14.1 allows OS administrators to obtain sensitive information from application server logs when debug logging is enabled. The fixed versions are 8.2.18.7, 8.2.18.2.2, 8.3.11.1, and 8.3.14.1.
- Product
- Terminalfour
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.terminalfour.comdocs.terminalfour.com
Apr 11, 2023Use of hard-coded credentials vulnerability in Buffalo network devices allows an attacker to access the debug function of the product.CVE-2023-26588 · Other software · BUFFALO INC. · reported by vultures@jpcert.or.jpHigh 7.5
Use of hard-coded credentials vulnerability in Buffalo network devices allows an attacker to access the debug function of the product. The affected products and versions are as follows: BS-GSL2024 firmware Ver. 1.10-0.03 and earlier, BS-GSL2016P firmware Ver. 1.10-0.03 and earlier, BS-GSL2016 firmware Ver. 1.10-0.03 and earlier, BS-GS2008 firmware Ver. 1.0.10.01 and earlier, BS-GS2016 firmware Ver. 1.0.10.01 and earlier, BS-GS2024 firmware Ver. 1.0.10.01 and earlier, BS-GS2048 firmware Ver. 1.0.10.01 and earlier, BS-GS2008P firmware Ver. 1.0.10.01 and earlier, BS-GS2016P firmware Ver. 1.0.10.01 and earlier, and BS-GS2024P firmware Ver. 1.0.10.01 and earlier
- Product
- BS-GSL and BS-GS series
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 4, 2023An issue found in Eteran edb-debugger v.1.3.0 allows a local attacker to causea denial of service via the collect_symbols function in plugins/BinaryInfo/symbolsCVE-2023-27734 · Other software · Edb-debugger Project · reported by MITREMedium 5.5
An issue found in Eteran edb-debugger v.1.3.0 allows a local attacker to causea denial of service via the collect_symbols function in plugins/BinaryInfo/symbols.cpp.
- Product
- Edb-debugger
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 4, 2023Authentication vulnerability found in Etcd-io v.3.4.10 allows remote attackers to escalate privileges via the debug function.CVE-2021-28235 · Other software · Etcd · reported by MITRECritical 9.8
Authentication vulnerability found in Etcd-io v.3.4.10 allows remote attackers to escalate privileges via the debug function.
- Product
- Etcd
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 29, 2023Malwarebytes AdwCleaner 8.4.0 runs as Administrator and performs an insecure file delete operation on C:\AdwCleaner\Logs\AdwCleaner_Debug.log in which the targeCVE-2023-28892 · Other software · Malwarebytes · reported by MITREHigh 7.8
Malwarebytes AdwCleaner 8.4.0 runs as Administrator and performs an insecure file delete operation on C:\AdwCleaner\Logs\AdwCleaner_Debug.log in which the target location is user-controllable, allowing a non-admin user to escalate privileges to SYSTEM via a symbolic link.
- Product
- Adwcleaner
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordforums.malwarebytes.commalwarebytes.com
Mar 27, 2023Juiker app stores debug logs which contains sensitive information to mobile external storage.CVE-2022-39043 · Other software · Juiker · reported by twcert@cert.org.twLow 2.4
Juiker app stores debug logs which contains sensitive information to mobile external storage. An unauthenticated physical attacker can access these files to acquire partial user information such as personal contacts.
- Product
- Juiker app
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtwcert.org.twtwcert.org.tw
Mar 24, 2023In (TBD) of (TBD), there is a possible way to boot with a hidden debug policy due to a missing warning to the user.CVE-2023-21068 · Computers, phones & browsers · Google · reported by security@android.comHigh 7.8
In (TBD) of (TBD), there is a possible way to boot with a hidden debug policy due to a missing warning to the user. This could lead to local escalation of privilege after preparing the device, hiding the warning, and passing the phone to a new user, with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-243433344References: N/A
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsource.android.comsource.android.com
Mar 11, 2023A vulnerability was found in dd32 Debug Bar Plugin up to 0.8 on WordPress.CVE-2013-10021 · WordPress plugins & themes · reported by VulDBLow 3.5
A vulnerability was found in dd32 Debug Bar Plugin up to 0.8 on WordPress. It has been declared as problematic. Affected by this vulnerability is the function render of the file panels/class-debug-bar-queries.php. The manipulation leads to cross site scripting. The attack can be launched remotely. Upgrading to version 0.8.1 is able to address this issue. The patch is named 0842af8f8a556bc3e39b9ef758173b0a8a9ccbfc. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-222739.
- Product
- dd32 Debug Bar
- Affected
- up to 0.8
- What to do
- Affects up to 0.8. Update dd32 Debug Bar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 27, 2023Sme.UP ERP TOKYO V6R1M220406 was discovered to contain an information disclosure vulnerability via the /debug endpoint.CVE-2023-26760 · Other software · Smeup · reported by MITREHigh 7.5
Sme.UP ERP TOKYO V6R1M220406 was discovered to contain an information disclosure vulnerability via the /debug endpoint. This vulnerability allows attackers to access cleartext credentials needed to authenticate to the AS400 system.
- Product
- ERP
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordswascan.comswascan.com
Feb 16, 2023Active debug code in some Intel (R) SPS firmware before version SPS_E5_04.04.04.300.0 may allow an authenticated user to potentially enable escalation of privilCVE-2022-36348 · Other software · Intel · reported by secure@intel.comHigh 8.8
Active debug code in some Intel (R) SPS firmware before version SPS_E5_04.04.04.300.0 may allow an authenticated user to potentially enable escalation of privilege via local access.
- Product
- Server Platform Services
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 10, 2023 Dell BSAFE SSL-J, versions before 6.5 and version 7.0 contain a debug message revealing unnecessary information vulnerability.CVE-2022-34364 · Other software · Dell · reported by security_alert@emc.comMedium 4.4
Dell BSAFE SSL-J, versions before 6.5 and version 7.0 contain a debug message revealing unnecessary information vulnerability. This may lead to disclosing sensitive information to a locally privileged user. .
- Product
- BSAFE SSL-J
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 2, 2023Active Debug Code vulnerability in robot controller of Mitsubishi Electric Corporation industrial robot MELFA SD/SQ Series and MELFA F-Series allows a remote unCVE-2022-33323 · Other software · Mitsubishi Electric Corporation · reported by Mitsubishielectric.Psirt@yd.MitsubishiElectric.co.jpHigh 7.5
Active Debug Code vulnerability in robot controller of Mitsubishi Electric Corporation industrial robot MELFA SD/SQ Series and MELFA F-Series allows a remote unauthenticated attacker to gain unauthorized access by authentication bypass through an unauthorized telnet login. As for the affected model names, controller types and firmware versions, see the Mitsubishi Electric's advisory which is listed in [References] section.
- Product
- MELFA SD/SQ Series Controller CR1DA-771 of RV-2SD
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 26, 2023A leftover debug code vulnerability exists in the httpd shell.cgi functionality of Siretta QUARTZ-GOLD G5.0.1.5-210720-141020.CVE-2022-38715 · Other software · Siretta · reported by talos-cna@cisco.comHigh 8.8
A leftover debug code vulnerability exists in the httpd shell.cgi functionality of Siretta QUARTZ-GOLD G5.0.1.5-210720-141020. A specially-crafted HTTP request can lead to remote code execution. An attacker can send an HTTP request to trigger this vulnerability.
- Product
- QUARTZ-GOLD
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtalosintelligence.comtalosintelligence.com
Jan 26, 2023The logs of sensitive information (PII) or hardware identifier should only be printed in Android "userdebug" or "eng" build.CVE-2022-20458 · Computers, phones & browsers · Google · reported by security@android.comMedium 5.5
The logs of sensitive information (PII) or hardware identifier should only be printed in Android "userdebug" or "eng" build. StatusBarNotification.getKey() could contain sensitive information. However, CarNotificationListener.java, it prints out the StatusBarNotification.getKey() directly in logs, which could contain user's account name (i.e. PII), in Android "user" build.Product: AndroidVersions: Android-12LAndroid ID: A-205567776
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsource.android.comsource.android.com
Jan 17, 2023Active debug code exists in OMRON CP1L-EL20DR-D all versions, which may lead to a command that is not specified in FINS protocol being executed without authentiCVE-2023-22357 · Other software · OMRON Corporation · reported by vultures@jpcert.or.jpCritical 9.8
Active debug code exists in OMRON CP1L-EL20DR-D all versions, which may lead to a command that is not specified in FINS protocol being executed without authentication. A remote unauthenticated attacker may read/write in arbitrary area of the device memory, which may lead to overwriting the firmware, causing a denial-of-service (DoS) condition, and/or arbitrary code execution.
- Product
- CP1L-EL20DR-D
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 9, 2023A vulnerability classified as problematic has been found in debug-js debug up to 3.0.x.CVE-2017-20165 · Other software · debug-js · reported by VulDBLow 3.5
A vulnerability classified as problematic has been found in debug-js debug up to 3.0.x. This affects the function useColors of the file src/node.js. The manipulation of the argument str leads to inefficient regular expression complexity. Upgrading to version 3.1.0 is able to address this issue. The identifier of the patch is c38a0166c266a679c8de012d4eaccec3f944e685. It is recommended to upgrade the affected component. The identifier VDB-217665 was assigned to this vulnerability.
- Product
- debug
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 23, 2022IP-COM M50 V15.11.0.33(10768) was discovered to contain multiple buffer overflows via the pEnable, pLevel, and pModule parameters in the formSetDebugCfg functioCVE-2022-45710 · Other software · Ip-com · reported by MITRECritical 9.8
IP-COM M50 V15.11.0.33(10768) was discovered to contain multiple buffer overflows via the pEnable, pLevel, and pModule parameters in the formSetDebugCfg function.
- Product
- M50 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 19, 2022Improper Input Validation vulnerability for the xdebug plugin in Apache Software Foundation Apache Traffic Server can lead to cross site scripting and cache poiCVE-2022-40743 · Websites & servers · Apache Software Foundation · reported by security@apache.orgMedium 6.1
Improper Input Validation vulnerability for the xdebug plugin in Apache Software Foundation Apache Traffic Server can lead to cross site scripting and cache poisoning attacks.This issue affects Apache Traffic Server: 9.0.0 to 9.1.3. Users should upgrade to 9.1.4 or later versions.
- Product
- Apache Traffic Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.apache.orglists.apache.org
Dec 18, 2022Hidden functionality vulnerability in Buffalo network devices allows a network-adjacent attacker with an administrative privilege to enable the debug functionalCVE-2022-43486 · Other software · BUFFALO INC. · reported by vultures@jpcert.or.jpMedium 6.8
Hidden functionality vulnerability in Buffalo network devices allows a network-adjacent attacker with an administrative privilege to enable the debug functionalities and execute an arbitrary command on the affected devices.
- Product
- WXR-5700AX7S
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 13, 2022Affected devices use a weak encryption scheme to encrypt the debug zip file.CVE-2022-46140 · Other software · Siemens · reported by productcert@siemens.comHigh 7.1
Affected devices use a weak encryption scheme to encrypt the debug zip file. This could allow an authenticated attacker to decrypt the contents of the file and retrieve debug information about the system.
- Product
- RUGGEDCOM RM1224 LTE(4G) EU
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcert-portal.siemens.comcert-portal.siemens.com
Dec 13, 2022Debug tool in Secomea SiteManager allows logged-in administrator to modify system state in an unintended manner.CVE-2022-38124 · Other software · Secomea · reported by VulnerabilityReporting@secomea.comMedium 5.7
Debug tool in Secomea SiteManager allows logged-in administrator to modify system state in an unintended manner.
- Product
- SiteManager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecomea.comsecomea.com
Dec 8, 2022Brocade SANnav before v2.2.1 logs usernames and encoded passwords in debug-enabled logs.CVE-2022-33187 · Other software · Brocade · reported by sirt@brocade.comMedium 5.5
Brocade SANnav before v2.2.1 logs usernames and encoded passwords in debug-enabled logs. The vulnerability could allow an attacker with admin privilege to read sensitive information.
- Product
- Brocade SANnav
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbroadcom.combroadcom.com
Nov 11, 2022Improper authentication in the Intel(R) SDP Tool before version 3.0.0 may allow an unauthenticated user to potentially enable information disclosure via networkCVE-2022-26508 · Other software · Intel · reported by secure@intel.comMedium 4.3
Improper authentication in the Intel(R) SDP Tool before version 3.0.0 may allow an unauthenticated user to potentially enable information disclosure via network access.
- Product
- Server Debug And Provisioning Tool
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 9, 2022A leftover debug code vulnerability exists in the console infct functionality of InHand Networks InRouter302 V3.5.45.CVE-2022-30543 · Other software · InHand Networks · reported by talos-cna@cisco.comHigh 8.8
A leftover debug code vulnerability exists in the console infct functionality of InHand Networks InRouter302 V3.5.45. A specially-crafted series of network requests can lead to execution of privileged operations. An attacker can send a sequence of requests to trigger this vulnerability.
- Product
- InRouter302
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordinhandnetworks.comtalosintelligence.com
Nov 9, 2022A leftover debug code vulnerability exists in the httpd port 4444 upload.cgi functionality of InHand Networks InRouter302 V3.5.45.CVE-2022-29888 · Other software · InHand Networks · reported by talos-cna@cisco.comHigh 8.1
A leftover debug code vulnerability exists in the httpd port 4444 upload.cgi functionality of InHand Networks InRouter302 V3.5.45. A specially-crafted HTTP request can lead to arbitrary file deletion. An attacker can send an HTTP request to trigger this vulnerability.
- Product
- InRouter302
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordinhandnetworks.comtalosintelligence.com
Nov 9, 2022A leftover debug code vulnerability exists in the console nvram functionality of InHand Networks InRouter302 V3.5.45.CVE-2022-29481 · Other software · InHand Networks · reported by talos-cna@cisco.comMedium 6.5
A leftover debug code vulnerability exists in the console nvram functionality of InHand Networks InRouter302 V3.5.45. A specially-crafted series of network requests can lead to disabling security features. An attacker can send a sequence of requests to trigger this vulnerability.
- Product
- InRouter302
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordinhandnetworks.comtalosintelligence.com
Nov 9, 2022A leftover debug code vulnerability exists in the console support functionality of InHand Networks InRouter302 V3.5.45.CVE-2022-28689 · Other software · InHand Networks · reported by talos-cna@cisco.comHigh 8.8
A leftover debug code vulnerability exists in the console support functionality of InHand Networks InRouter302 V3.5.45. A specially-crafted network request can lead to arbitrary command execution. An attacker can send a sequence of requests to trigger this vulnerability.
- Product
- InRouter302
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordinhandnetworks.comtalosintelligence.com
Nov 9, 2022A leftover debug code vulnerability exists in the console verify functionality of InHand Networks InRouter302 V3.5.45.CVE-2022-26023 · Other software · InHand Networks · reported by talos-cna@cisco.comMedium 6.5
A leftover debug code vulnerability exists in the console verify functionality of InHand Networks InRouter302 V3.5.45. A specially-crafted series of network requests can lead to disabling security features. An attacker can send a sequence of requests to trigger this vulnerability.
- Product
- InRouter302
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordinhandnetworks.comtalosintelligence.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.